Hacker News Reader

Comment by rootsudo | Hacker News Reader

This has bene known in the automtive/security world forever, you can google replay attacks and people demonstrate this.

German cars do have a rolling code, especially BMW with EWS2 around 1996'and it's a nicely documented system to break.

With that said, it would be fun to dump older car firmware to see how simple the security was, previous to 1996, most cars ECU firmware were litereally on eproms.

There are also communities and such dedicated to bypassing this, not for theft but for engine swapping and car modification - having an annoying security system that can disable the starter or fuel pump sucks when you engine swapped your car.

View on HN

The news here is the fact that this very old and well-known attack works on cars in the 2020/2021 model years. This is pretty surprising, since the appropriate countermeasures have been widely-deployed even in inexpensive cars for well over a decade. Modern “keyless” vehicles have largely moved on to dealing with relay attacks, which is at least a more challenging class of attack than this one.

Honestly keyless go is a clusterfuck. Cars are getting stolen all over the place. Police says to wrap keys in tinfoil.

It's not particularly obvious why insurers don't seem to care, though there have been some rulings where they didn't need to pay because stealing a car like this wasn't technically stealing under the insurance policy.

Insurers don't care because vulnerability can be predicted by make/model/year so they a) can readily predict how much they'll pay out, are all saddled with the same cost increase (per vulnerable vehicle) and are free to pass that on to customers knowing that the competition has to do the same so they won't be undercut. Basically they don't care because the cost passes right through them with minimal friction in this case.

That assumes a static level of exploitation. If criminal gangs decide that Honda/Acura is the low-hanging fruit and ramp up theft of these vehicles, the insurance companies will have to react with increased insurance costs, which will put pressure on the manufacturers since it raises TCOO.

Insurance renews every 6 or 12 months. At least in the US criminal gangs are fairly decentralized, so it seems insurance companies are on somewhat even ground with any shift in crime patterns.

Insurers don't care because risk is proportionate to cost. Hence actuaries.

>though there have been some rulings where they didn't need to pay because stealing a car like this wasn't technically stealing under the insurance policy.

Link? This seems so wild.

I'm guessing it's because the key has to be present for a relay (not replay) attack, so it's analogous to the way "card present" shifts some of the liability in payment card fraud? Pretty wild that the authorized user should know to protect against key fob relays though.

Fun fact: they usually go to sleep (i.e., way more battery life) based on an accelerometer detecting no motion, because legitimate use would always be hand-held. To take advantage, put it on a table or hook (but not too close to your front door, perhaps) instead of keeping it in your pocket while home.

Is motion sensor on key fob common even for cheaper cars?

It seems to be a mixed bag. https://www.iaati.org/news/entry/thatcham-releases-latest-re...

I guess sleep mode is really more about preventing relay attacks, with improved battery life being a side effect.

I had key pouches that I put my keys inside without fail. Wasn't a problem for me personally but it is a potential thing for average Joes to not think about or remember to do

It also really sux when you have to repair those security systems. I honestly would forgo the entire encryption fob thing in favor of a decent mechanical key for starting the car. Sure, they can be bypassed, but if someone is under your hood crossing wires then you have bigger problems.

Or better yet, an S&G digital safe lock. If it is good enough for missile launch codes it is good enough for my civic. Replacing an S&G lock body is far cheaper than any car immobilizer.

00000000 was good enough to secure nukes for a long time[1]

1: https://arstechnica.com/tech-policy/2013/12/launch-code-for-...

Better than having the "more secure" number on a post-it on the side of the bomb. :-)

A digital keypad and a phone based system would be best. Apps can be updated for security, and the cars firmware can be updated via the app too. The keypad means even if a purse is stolen with the phone and keys in it, you can still start your car.

Ford has keypad entry on a number of models, for example.

If someone wants to get in via the keypad, there is a list [0] that was mentioned on HN [1]. The list is 3129 numbers, which if pressed in sequence, will eventually open the door because all of the possible code permutations are contained in that sequence.

[0] https://everything2.com/index.pl?node_id=1520430&displaytype...

[1] https://news.ycombinator.com/item?id=7622165

If you have 20 minutes with a car you can get in many ways..

If you have that much time, you might as well pick the lock or shim the door.

If they can't secure their own keyfob, I'd be worried that a phone app will open a remote vunerability.

My car has an optional subscription that would let me unlock it with my phone -- I didn't sign up for that subscription, but I bet that it's active on the car's side and if there's a remote vulnerability, it's exploitable whether I've signed up for it or not.

I stopped carrying my keyfob a few years ago, and just use the mechanical key - mainly because I hate how huge it is, but now I'm starting to think it was a good idea..

I really like the convenience of keyless entry, I keep my key in my backpack and like being able to walk up to the car, have it automatically unlock when I grab the door handle, then I just get in and press "start", and it's ready to go. Then when I get to work, I just grab my backpack and walk away and I know the car will lock behind me. I don't want to move back to a physical key.

That convenience shouldn't have to be traded for the huge vulnerability of allowing replay attacks.

Yeah, no. Key fobs are great. I wish I had them. My moms car unlocks the door if the key is in my pocket. Immensely useful while carrying bags and a decade old feature.

Door keys suck. Ignition keys suck more. The worst is the middle years of both immobilizers and physical keys.

Source: I can use 4 different keys to open 1 car right now. In fact, I only realized this after I locked my keys in the car and tried a few spares at the shop. A little jiggle and they all work

For doors, ya, but to start the engine i hate these new cars that dont have any mechanical key.

As far as I understand even physical car keys tended to be on the low end. With a decent chance that you could find a different car by the same manufacturer that you could at least unlock with your key.

Yeah a friend of mine had that. Almost drove away in the wrong car, luckily he noticed "weird CDs" lying around.

Old Subaru by any chance…?

Literally any vehicle with a worn out ignition cylinder from 100k of keys hanging off of it.

Fun-fact: you can lock any Ford with a 6-sided key (not sure what those are called) of your Ford...

Funner-fact: you can lock any car that's unlocked by opening up the door and locking it.

Not my Bolt. Even if the key is nowhere on your person or in the car, it steadfastly refuses to let you lock the door that way. If you push the lock button while the door is open, it immediately unlocks it for you.

It would make sense to do that if it detected the fob inside the car. But it does it no matter what.

If you lose your keys, you can't lock the car up and come back with the spare?

That's not a feature.

Your spare would be your cell phone app.

I agree, it's not a feature. It's annoying.

I agree, but realistically the car is already locked when you lose your keys, assuming you lock your car when you leave it. An exception would be, say, dropping your keys down a storm drain after getting out and before walking away, but even this is becoming unusual as more cars have push-to-start and capacitive exterior touch areas such that your key is always in your pocket.

most modern cars will not let you do this as to prevent accidental car-on-while-locked or locked-keys scenarios.

My '82 Honda didn't work that way (it would pop the lock open again when the door was closed), I'd be surprised if anything modern still worked in such a manner (nothing I own does).

Many older cars require you to hold the handle up while you close the door to prevent you from accidentally locking yourself out.

Why bother with a key?

> To lock all doors, with the driver door closed, press and hold 7•8 and 9•0 at the same time. You do not need to enter the keypad code first.

https://www.ford.com/support/how-tos/keys-and-locks/securico...

The key from a 2001 GMC Savannah opened the doors of our 2002 Chevy Express (same van model, different badges). Though the Express key could not open the Savannah. Either key did not work in each others ignition lock.

Barely on topic, but I accidentally stole a bike due to this issue. Somebody parked their bike in the same rack, same model, same color, same brand of lock, and my key popped it right open. About half way home I finally realized why the seat felt funny. Drove back and swapped it with my own, I hope nobody noticed.

Long ago, I unlocked the wrong VW Rabbit, and was briefly surprised when I couldn't start it. More recently (last dozen or so years) the NY Times Sunday Magazine had a short piece, something like "Dude, Where's Your Car", about a woman actually driving off with the wrong car, and having to arrange its return to the owner.

I used to drive a Nissan whose doors would unlock when you closed a door - I'm not sure if it was intentional or not. But I found I could also trigger the unlocking mechanism by punching the outside of the door at just the right spot. Very useful for when ice would get in the locks.

It was intentional. It's so you can't lock your keys inside.

I had a Mazda with this feature, apparently very common among Japanese cars in the early 90s. At first I thought it was broken, until I started looking into how to fix it and found you just have to pull the handle as you're closing the door to stop it from popping up. It's supposed to make you think about grabbing your keys but after a while it sort of became automatic.

I've got an early 80s SAAB that handled this in a more straightforward way. The driver's door lock plunger will not go down while the door is open, forcing you to lock it with the key (or reach around from another door, and then lock that.)

When I was an auto mechanic back in the days before key fobs, I'd driven the wrong car into the bay...twice, that I recall. I even changed the oil on one of those cars, when it was in for a brake job. It was the other blue '85 Chevy Malibu that needed the oil change.

Someone once drove my car away from the SJ airport lot as a favor for his friend, who was quite surprised to be picked up in someone else's blue Camry.

I took a class on SDRs one time and replay attack against a Honda was one of the toy examples they used as homework.

Reply on news.ycombinator.com